Hey Tony,
As I understand it the S9 has an open API that will let anyone logon to it and change what they want if they can get on your network. Typical from Shitmain, get behind a firewall and you should be good until those with more knowledge of this chime in and give you better/more detailed advice.
This is assuming you have an S9, not sure about the others but if one is open...
Thanks for the reply. I do unfortunately open a port forwarding on my main router just so I can check my miner status outside the house.
Here's the router log of the access:
[DoS Attack: RST Scan] from source: 46.4.73.199, port 443, Thursday, August 04, 2016 10:34:56
[DHCP IP: 192.168.1.19] to MAC address 24:77:03:07:44:8c, Thursday, August 04, 2016 10:34:53
[DoS Attack: RST Scan] from source: 46.4.73.199, port 443, Thursday, August 04, 2016 10:33:56
[DoS Attack: RST Scan] from source: 24.244.4.25, port 80, Thursday, August 04, 2016 10:32:41
[admin login] from source 192.168.1.51, Thursday, August 04, 2016 10:32:39
[DoS Attack: RST Scan] from source: 46.4.73.199, port 443, Thursday, August 04, 2016 10:32:36
[DHCP IP: 192.168.1.17] to MAC address 00:44:fa:86:16:43, Thursday, August 04, 2016 10:32:07
[DHCP IP: 192.168.1.17] to MAC address 00:44:fa:86:16:43, Thursday, August 04, 2016 10:31:46
[DoS Attack: RST Scan] from source: 46.4.73.199, port 443, Thursday, August 04, 2016 10:30:56
[DoS Attack: SYN/ACK Scan] from source: 91.225.237.39, port 80, Thursday, August 04, 2016 10:30:54
[DoS Attack: RST Scan] from source: 46.4.73.199, port 443, Thursday, August 04, 2016 10:14:46
[color=red][b][LAN access from remote] from 178.156.11.35:13328 to 192.168.1.17:80, Thursday, August 04, 2016 10:13:32[/b][/color]
[DoS Attack: Xmas Tress Scan] from source: 212.71.238.108, port 52100, Thursday, August 04, 2016 10:12:42
and 10:13 is about the exact time my miner got disconnected from my pool.
The access IP was 178.156.11.35 from Spain but it could be through a proxy.